DOCSEARCHbyAlgolia
Submit Docs

RustRedOps

repository·main·Indexed 23 days ago

https://github.com/joaoviictorti/rustredops

A repository of offensive security tools and techniques implemented in Rust for Windows environments. It includes implementations for process injection (APC and Function Stomping), anti-analysis, API hooking, and AMSI/ETW patching. The project also covers COM interface abuse, shellcode execution via callbacks, compile-time string encryption using the obf macro, and the creation of DLLs, kernel drivers, and UEFI applications.

Tokens
38.6K
Snippets
95
Records
207
Agent score
84%

What's inside RustRedOps

  1. Overview of AMSI Patching in RustRedOps

    main
    The patch_amsi package provides techniques for patching Microsoft's Antimalware Scan Interface (AMSI). AMSI is a standard interface used by software applications and services to integrate with anti-malware solutions on a system. This project implements sophisticated patching methods to bypass or neutralize AMSI's scanning capabilities.

  2. Overview of Anti-Analysis techniques in RustRedOps

    main
    The anti_analysis package provides techniques designed to detect or evade environments that are virtualized or sandboxed. These techniques aim to make it difficult or impossible for code to execute successfully when it detects it is being monitored or analyzed in a controlled environment.

  4. Overview of RustRedOps projects

    main

    The repository contains numerous specialized offensive security projects. Key categories include:

    • Injection Techniques: APC Injection, Mapping Injection, Function Stomping, Module Stomping, Process Injection, Threadless Injection, and Process Ghosting.
    • Evasion & Anti-Analysis: Anti-Debug, Anti-Analysis, API Hammering, IAT Obfuscation, IAT Camouflage, ETW Patching, AMSI Patching, and Process Argument Spoofing.
    • Payload Execution: Callback Code Execution, Local Payload Execution, Local PE Injection, Payload Execution via Fibers, and WebAssembly Shellcode.
    • System Manipulation: API Hooking, NTDLL Unhooking, PPID Spoofing, and Syscalls (direct and indirect).
    • Information Gathering & Utilities: Binary Info (metadata/icons), Extract WIFI (via winapis), Enumeration Processes, and Parsing PE Headers.

  5. Overview of Create DLL for Rust

    main
    This component serves as a starting point for security specialists who want to develop Dynamic Link Libraries (DLLs) using the Rust programming language. It is designed to facilitate the creation of DLLs within the context of offensive security research and development.

  8. Include metadata and change icons in a Rust binary

    main
    The binary_info package provides a demonstration of how to embed metadata into a Rust binary or change its associated icon. This is typically achieved through configuration in the Cargo.toml file or using specific build attributes, allowing the resulting executable to carry specific identity information or visual assets.

  11. Techniques using COM Interfaces

    main

    The COM directory in RustRedOps contains implementations of various Windows Component Object Model (COM) interfaces that can be used for offensive operations. These techniques allow for code execution, file transfers, command execution, and network communication by leveraging legitimate Windows system components.

    Available COM-based techniques include:

    • IActiveScript: Executes VBScript or JScript code within the current process using the Windows Script engine.
    • IBackgroundCopyManager: Utilizes the Background Intelligent Transfer Service (BITS) to transfer files.
    • IHxHelpPaneServer: Abuses the Help Pane process to spawn executables via file:// paths.
    • IHxInteractiveUser: Triggers process creation through Help interaction (similar to IHxHelpPaneServer).
    • IShellDispatch: Executes system commands or programs via the Windows Shell (ShellExecute).
    • IShellLink: Manipulates Windows shortcut (.lnk) files to point to arbitrary executables.
    • IWinHttpRequest: Performs HTTP/HTTPS requests directly from COM for data exfiltration or remote command retrieval.
    • IXMLDOMDocument: Executes XSLT scripts or transforms XML data containing embedded code for command execution.

  12. What is the Block DLL Policy technique

    main

    The Block DLL Policy technique is a defensive evasion strategy used to prevent non-Microsoft-signed DLLs from being loaded into system processes. This can be implemented in two ways:

    1. Process Creation: Applying the policy when spawning new processes to ensure they only load trusted Microsoft-signed DLLs.
    2. Local Process Implementation: Implementing the policy within the current local process to restrict the loading of unauthorized DLLs.